feat(audit-logging): Adds audit logging support#355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 17 commits into from
Jun 18, 2025
Merged

feat(audit-logging): Adds audit logging support #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
13a7fb2
add audit factory skeleton
msukkari Jun 12, 2025
cba10b8
add additional audit events
msukkari Jun 13, 2025
584a8d1
add more audit logs
msukkari Jun 13, 2025
a66abf2
delete account join request when redeeming an invite
msukkari Jun 13, 2025
3f7734d
Merge branch 'msukkarieh/stale_join_request' into msukkarieh/audit
msukkari Jun 13, 2025
e9f80f0
add audit event for account request removed
msukkari Jun 14, 2025
0ba23c9
merge main
msukkari Jun 14, 2025
b00a429
Merge branch 'main' into msukkarieh/audit
msukkari Jun 14, 2025
559633c
wip api to fetch audits
msukkari Jun 17, 2025
9c97889
add check for audit with public access and entitlement
msukkari Jun 17, 2025
a38f2c4
merge main
msukkari Jun 17, 2025
185fcfa
fix issues with merge
msukkari Jun 17, 2025
47adbb4
add docs for audit logs
msukkari Jun 17, 2025
4aa5923
add proper audit log for audit fetch and proper handling of api key h…
msukkari Jun 17, 2025
85ce7ae
merge main
msukkari Jun 17, 2025
51606f2
format nit
msukkari Jun 17, 2025
c9876e9
feedback
msukkari Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Added
- Added audit logging. [#355](https://github.com/sourcebot-dev/sourcebot/pull/355)
<!-- @NOTE: this release includes a API change that affects the MCP package (@sourcebot/mcp). On release, bump the MCP package's version and delete this message. -->

### Fixed
Expand Down
3 changes: 2 additions & 1 deletion docs/docs.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,8 @@
]
},
"docs/configuration/transactional-emails",
"docs/configuration/structured-logging"
"docs/configuration/structured-logging",
"docs/configuration/audit-logs"
]
},
{
Expand Down
212 changes: 212 additions & 0 deletions docs/docs/configuration/audit-logs.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
---
title: Audit Logs
sidebarTitle: Audit logs
---

import LicenseKeyRequired from '/snippets/license-key-required.mdx'

<LicenseKeyRequired />

Audit logs are a collection of notable events performed by users within a Sourcebot deployment. Each audit log records information on the action taken, the user who performed the
action, and when the action took place.

This feature gives security and compliance teams the necessary information to ensure proper governance and administration of your Sourcebot deployment.

## Enabling Audit Logs
Audit logs must be explicitly enabled by setting the `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` [environment variable](/docs/configuration/environment-variables) to `true`

## Fetching Audit Logs
Audit logs are stored in the [postgres database](/docs/overview#architecture) connected to Sourcebot. To fetch all of the audit logs, you can use the following API:

```bash icon="terminal" Fetch audit logs
curl --request GET '$SOURCEBOT_URL/api/ee/audit' \
--header 'X-Org-Domain: ~' \
--header 'X-Sourcebot-Api-Key: $SOURCEBOT_OWNER_API_KEY'
```

```json icon="brackets-curly" wrap expandable Fetch audit logs example response
[
{
"id": "cmc146k7m0003xgo2tri5t4br",
"timestamp": "2025-06-17T22:48:08.914Z",
"action": "api_key.created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "205d1da1c6c3772b81d4ad697f5851fa11195176c211055ff0c1509772645d6d",
"targetType": "api_key",
"sourcebotVersion": "unknown",
"orgId": 1
},
{
"id": "cmc146c8r0001xgo2xyu0p463",
"timestamp": "2025-06-17T22:47:58.587Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12vqgb0008xgn5nv5hl9y5",
"timestamp": "2025-06-17T22:11:44.171Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12txwn0006xgn51ow1odid",
"timestamp": "2025-06-17T22:10:20.519Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12tnjx0004xgn5qqeiv1ao",
"timestamp": "2025-06-17T22:10:07.101Z",
"action": "user.owner_created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
},
{
"id": "cmc12tnjh0002xgn5h6vzu3rl",
"timestamp": "2025-06-17T22:10:07.086Z",
"action": "user.signed_in",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "cmc12tnje0000xgn58jj8655h",
"targetType": "user",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
}
]
```

## Audit action types

| Action | Actor Type | Target Type |
| :------- | :------ | :------|
| `api_key.creation_failed` | `user` | `org` |
| `api_key.created` | `user` | `api_key` |
| `api_key.deletion_failed` | `user` | `org` |
| `api_key.deleted` | `user` | `api_key` |
| `user.creation_failed` | `user` | `user` |
| `user.owner_created` | `user` | `org` |
| `user.jit_provisioning_failed` | `user` | `org` |
| `user.jit_provisioned` | `user` | `org` |
| `user.join_request_creation_failed` | `user` | `org` |
| `user.join_requested` | `user` | `org` |
| `user.join_request_approve_failed` | `user` | `account_join_request` |
| `user.join_request_approved` | `user` | `account_join_request` |
| `user.join_request_removed` | `user` | `account_join_request` |
| `user.invite_failed` | `user` | `org` |
| `user.invites_created` | `user` | `org` |
| `user.invite_accept_failed` | `user` | `invite` |
| `user.invite_accepted` | `user` | `invite` |
| `user.signed_in` | `user` | `user` |
| `user.signed_out` | `user` | `user` |
| `org.ownership_transfer_failed` | `user` | `org` |
| `org.ownership_transferred` | `user` | `org` |
| `query.file_source` | `user \| api_key` | `file` |
| `query.code_search` | `user \| api_key` | `org` |
| `query.list_repositories` | `user \| api_key` | `org` |


## Response schema

```json icon="brackets-curly" expandable wrap Audit log fetch response schema
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "FetchAuditLogsResponse",
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"timestamp",
"action",
"actorId",
"actorType",
"targetId",
"targetType",
"sourcebotVersion",
"metadata",
"orgId"
],
"properties": {
"id": {
"type": "string"
},
"timestamp": {
"type": "string",
"format": "date-time"
},
"action": {
"type": "string"
},
"actorId": {
"type": "string"
},
"actorType": {
"type": "string",
"enum": ["user", "api_key"]
},
"targetId": {
"type": "string"
},
"targetType": {
"type": "string",
"enum": ["user", "org", "file", "api_key", "account_join_request", "invite"]
},
"sourcebotVersion": {
"type": "string"
},
"metadata": {
"anyOf": [
{
"type": "object",
"properties": {
"message": { "type": "string" },
"api_key": { "type": "string" },
"emails": { "type": "string" }
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"orgId": {
"type": "integer"
}
},
"additionalProperties": false
}
}

```
1 change: 1 addition & 0 deletions docs/docs/configuration/environment-variables.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,6 +39,7 @@ The following environment variables allow you to configure your Sourcebot deploy
### Enterprise Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` | `false` | <p>Enables/disables audit logging</p> |
| `AUTH_EE_ENABLE_JIT_PROVISIONING` | `false` | <p>Enables/disables just-in-time user provisioning for SSO providers.</p> |
| `AUTH_EE_GITHUB_BASE_URL` | `https://github.com` | <p>The base URL for GitHub Enterprise SSO authentication.</p> |
| `AUTH_EE_GITHUB_CLIENT_ID` | `-` | <p>The client ID for GitHub Enterprise SSO authentication.</p> |
Expand Down
3 changes: 2 additions & 1 deletion docs/docs/configuration/structured-logging.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
---
title: Structured logging
title: Structured Logging
sidebarTitle: Structured logging
---

By default, Sourcebot will output logs to the console in a human readable format. If you'd like Sourcebot to output structured JSON logs, set the following env vars:
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/deployment-guide.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,7 +33,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot
<Step title="Create a config.json">
Create a `config.json` file that tells Sourcebot which repositories to sync and index:

```bash
```bash wrap icon="terminal" Create example config
touch config.json
echo '{
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
Expand All@@ -58,7 +58,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot

In the same directory as `config.json`, run the following command to start your instance:

``` bash
``` bash icon="terminal" Start the Sourcebot container
docker run \
-p 3000:3000 \
--pull=always \
Expand Down
21 changes: 21 additions & 0 deletions packages/db/prisma/migrations/20250617031335_add_audit_table/migration.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
-- CreateTable
CREATE TABLE "Audit" (
"id" TEXT NOT NULL,
"timestamp" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"action" TEXT NOT NULL,
"actorId" TEXT NOT NULL,
"actorType" TEXT NOT NULL,
"targetId" TEXT NOT NULL,
"targetType" TEXT NOT NULL,
"sourcebotVersion" TEXT NOT NULL,
"metadata" JSONB,
"orgId" INTEGER NOT NULL,

CONSTRAINT "Audit_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "Audit_actorId_actorType_targetId_targetType_orgId_idx" ON "Audit"("actorId", "actorType", "targetId", "targetType", "orgId");

-- AddForeignKey
ALTER TABLE "Audit" ADD CONSTRAINT "Audit_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
20 changes: 20 additions & 0 deletions packages/db/prisma/schema.prisma
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -172,6 +172,8 @@ model Org {
/// List of pending invites to this organization
invites Invite[]

audits Audit[]

accountRequests AccountRequest[]

searchContexts SearchContext[]
Expand DownExpand Up@@ -227,6 +229,24 @@ model ApiKey {

}

model Audit {
id String @id @default(cuid())
timestamp DateTime @default(now())

action String
actorId String
actorType String
targetId String
targetType String
sourcebotVersion String
metadata Json?

org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
orgId Int

@@index([actorId, actorType, targetId, targetType, orgId])
}

// @see : https://authjs.dev/concepts/database-models#user
model User {
id String @id @default(cuid())
Expand Down
7 changes: 4 additions & 3 deletions packages/shared/src/entitlements.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,15 +36,16 @@ const entitlements = [
"public-access",
"multi-tenancy",
"sso",
"code-nav"
"code-nav",
"audit"
] as const;
export type Entitlement = (typeof entitlements)[number];

const entitlementsByPlan: Record<Plan, Entitlement[]> = {
oss: [],
"cloud:team": ["billing", "multi-tenancy", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav", "audit"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav", "audit"],
// Special entitlement for https://demo.sourcebot.dev
"cloud:demo": ["public-access", "code-nav", "search-contexts"],
} as const;
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all \u003cpre\u003e\u003ccode\u003e blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks"); } } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); } })(); (function(){ try { var __m = "github.com"; var __re = new RegExp('^' + "github\\.com" + '
Skip to content

feat(audit-logging): Adds audit logging support#355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 17 commits into from
Jun 18, 2025
Merged

feat(audit-logging): Adds audit logging support #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
13a7fb2
add audit factory skeleton
msukkari Jun 12, 2025
cba10b8
add additional audit events
msukkari Jun 13, 2025
584a8d1
add more audit logs
msukkari Jun 13, 2025
a66abf2
delete account join request when redeeming an invite
msukkari Jun 13, 2025
3f7734d
Merge branch 'msukkarieh/stale_join_request' into msukkarieh/audit
msukkari Jun 13, 2025
e9f80f0
add audit event for account request removed
msukkari Jun 14, 2025
0ba23c9
merge main
msukkari Jun 14, 2025
b00a429
Merge branch 'main' into msukkarieh/audit
msukkari Jun 14, 2025
559633c
wip api to fetch audits
msukkari Jun 17, 2025
9c97889
add check for audit with public access and entitlement
msukkari Jun 17, 2025
a38f2c4
merge main
msukkari Jun 17, 2025
185fcfa
fix issues with merge
msukkari Jun 17, 2025
47adbb4
add docs for audit logs
msukkari Jun 17, 2025
4aa5923
add proper audit log for audit fetch and proper handling of api key h…
msukkari Jun 17, 2025
85ce7ae
merge main
msukkari Jun 17, 2025
51606f2
format nit
msukkari Jun 17, 2025
c9876e9
feedback
msukkari Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Added
- Added audit logging. [#355](https://github.com/sourcebot-dev/sourcebot/pull/355)
<!-- @NOTE: this release includes a API change that affects the MCP package (@sourcebot/mcp). On release, bump the MCP package's version and delete this message. -->

### Fixed
Expand Down
3 changes: 2 additions & 1 deletion docs/docs.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,8 @@
]
},
"docs/configuration/transactional-emails",
"docs/configuration/structured-logging"
"docs/configuration/structured-logging",
"docs/configuration/audit-logs"
]
},
{
Expand Down
212 changes: 212 additions & 0 deletions docs/docs/configuration/audit-logs.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
---
title: Audit Logs
sidebarTitle: Audit logs
---

import LicenseKeyRequired from '/snippets/license-key-required.mdx'

<LicenseKeyRequired />

Audit logs are a collection of notable events performed by users within a Sourcebot deployment. Each audit log records information on the action taken, the user who performed the
action, and when the action took place.

This feature gives security and compliance teams the necessary information to ensure proper governance and administration of your Sourcebot deployment.

## Enabling Audit Logs
Audit logs must be explicitly enabled by setting the `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` [environment variable](/docs/configuration/environment-variables) to `true`

## Fetching Audit Logs
Audit logs are stored in the [postgres database](/docs/overview#architecture) connected to Sourcebot. To fetch all of the audit logs, you can use the following API:

```bash icon="terminal" Fetch audit logs
curl --request GET '$SOURCEBOT_URL/api/ee/audit' \
--header 'X-Org-Domain: ~' \
--header 'X-Sourcebot-Api-Key: $SOURCEBOT_OWNER_API_KEY'
```

```json icon="brackets-curly" wrap expandable Fetch audit logs example response
[
{
"id": "cmc146k7m0003xgo2tri5t4br",
"timestamp": "2025-06-17T22:48:08.914Z",
"action": "api_key.created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "205d1da1c6c3772b81d4ad697f5851fa11195176c211055ff0c1509772645d6d",
"targetType": "api_key",
"sourcebotVersion": "unknown",
"orgId": 1
},
{
"id": "cmc146c8r0001xgo2xyu0p463",
"timestamp": "2025-06-17T22:47:58.587Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12vqgb0008xgn5nv5hl9y5",
"timestamp": "2025-06-17T22:11:44.171Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12txwn0006xgn51ow1odid",
"timestamp": "2025-06-17T22:10:20.519Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12tnjx0004xgn5qqeiv1ao",
"timestamp": "2025-06-17T22:10:07.101Z",
"action": "user.owner_created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
},
{
"id": "cmc12tnjh0002xgn5h6vzu3rl",
"timestamp": "2025-06-17T22:10:07.086Z",
"action": "user.signed_in",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "cmc12tnje0000xgn58jj8655h",
"targetType": "user",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
}
]
```

## Audit action types

| Action | Actor Type | Target Type |
| :------- | :------ | :------|
| `api_key.creation_failed` | `user` | `org` |
| `api_key.created` | `user` | `api_key` |
| `api_key.deletion_failed` | `user` | `org` |
| `api_key.deleted` | `user` | `api_key` |
| `user.creation_failed` | `user` | `user` |
| `user.owner_created` | `user` | `org` |
| `user.jit_provisioning_failed` | `user` | `org` |
| `user.jit_provisioned` | `user` | `org` |
| `user.join_request_creation_failed` | `user` | `org` |
| `user.join_requested` | `user` | `org` |
| `user.join_request_approve_failed` | `user` | `account_join_request` |
| `user.join_request_approved` | `user` | `account_join_request` |
| `user.join_request_removed` | `user` | `account_join_request` |
| `user.invite_failed` | `user` | `org` |
| `user.invites_created` | `user` | `org` |
| `user.invite_accept_failed` | `user` | `invite` |
| `user.invite_accepted` | `user` | `invite` |
| `user.signed_in` | `user` | `user` |
| `user.signed_out` | `user` | `user` |
| `org.ownership_transfer_failed` | `user` | `org` |
| `org.ownership_transferred` | `user` | `org` |
| `query.file_source` | `user \| api_key` | `file` |
| `query.code_search` | `user \| api_key` | `org` |
| `query.list_repositories` | `user \| api_key` | `org` |


## Response schema

```json icon="brackets-curly" expandable wrap Audit log fetch response schema
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "FetchAuditLogsResponse",
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"timestamp",
"action",
"actorId",
"actorType",
"targetId",
"targetType",
"sourcebotVersion",
"metadata",
"orgId"
],
"properties": {
"id": {
"type": "string"
},
"timestamp": {
"type": "string",
"format": "date-time"
},
"action": {
"type": "string"
},
"actorId": {
"type": "string"
},
"actorType": {
"type": "string",
"enum": ["user", "api_key"]
},
"targetId": {
"type": "string"
},
"targetType": {
"type": "string",
"enum": ["user", "org", "file", "api_key", "account_join_request", "invite"]
},
"sourcebotVersion": {
"type": "string"
},
"metadata": {
"anyOf": [
{
"type": "object",
"properties": {
"message": { "type": "string" },
"api_key": { "type": "string" },
"emails": { "type": "string" }
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"orgId": {
"type": "integer"
}
},
"additionalProperties": false
}
}

```
1 change: 1 addition & 0 deletions docs/docs/configuration/environment-variables.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,6 +39,7 @@ The following environment variables allow you to configure your Sourcebot deploy
### Enterprise Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` | `false` | <p>Enables/disables audit logging</p> |
| `AUTH_EE_ENABLE_JIT_PROVISIONING` | `false` | <p>Enables/disables just-in-time user provisioning for SSO providers.</p> |
| `AUTH_EE_GITHUB_BASE_URL` | `https://github.com` | <p>The base URL for GitHub Enterprise SSO authentication.</p> |
| `AUTH_EE_GITHUB_CLIENT_ID` | `-` | <p>The client ID for GitHub Enterprise SSO authentication.</p> |
Expand Down
3 changes: 2 additions & 1 deletion docs/docs/configuration/structured-logging.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
---
title: Structured logging
title: Structured Logging
sidebarTitle: Structured logging
---

By default, Sourcebot will output logs to the console in a human readable format. If you'd like Sourcebot to output structured JSON logs, set the following env vars:
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/deployment-guide.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,7 +33,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot
<Step title="Create a config.json">
Create a `config.json` file that tells Sourcebot which repositories to sync and index:

```bash
```bash wrap icon="terminal" Create example config
touch config.json
echo '{
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
Expand All@@ -58,7 +58,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot

In the same directory as `config.json`, run the following command to start your instance:

``` bash
``` bash icon="terminal" Start the Sourcebot container
docker run \
-p 3000:3000 \
--pull=always \
Expand Down
21 changes: 21 additions & 0 deletions packages/db/prisma/migrations/20250617031335_add_audit_table/migration.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
-- CreateTable
CREATE TABLE "Audit" (
"id" TEXT NOT NULL,
"timestamp" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"action" TEXT NOT NULL,
"actorId" TEXT NOT NULL,
"actorType" TEXT NOT NULL,
"targetId" TEXT NOT NULL,
"targetType" TEXT NOT NULL,
"sourcebotVersion" TEXT NOT NULL,
"metadata" JSONB,
"orgId" INTEGER NOT NULL,

CONSTRAINT "Audit_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "Audit_actorId_actorType_targetId_targetType_orgId_idx" ON "Audit"("actorId", "actorType", "targetId", "targetType", "orgId");

-- AddForeignKey
ALTER TABLE "Audit" ADD CONSTRAINT "Audit_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
20 changes: 20 additions & 0 deletions packages/db/prisma/schema.prisma
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -172,6 +172,8 @@ model Org {
/// List of pending invites to this organization
invites Invite[]

audits Audit[]

accountRequests AccountRequest[]

searchContexts SearchContext[]
Expand DownExpand Up@@ -227,6 +229,24 @@ model ApiKey {

}

model Audit {
id String @id @default(cuid())
timestamp DateTime @default(now())

action String
actorId String
actorType String
targetId String
targetType String
sourcebotVersion String
metadata Json?

org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
orgId Int

@@index([actorId, actorType, targetId, targetType, orgId])
}

// @see : https://authjs.dev/concepts/database-models#user
model User {
id String @id @default(cuid())
Expand Down
7 changes: 4 additions & 3 deletions packages/shared/src/entitlements.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,15 +36,16 @@ const entitlements = [
"public-access",
"multi-tenancy",
"sso",
"code-nav"
"code-nav",
"audit"
] as const;
export type Entitlement = (typeof entitlements)[number];

const entitlementsByPlan: Record<Plan, Entitlement[]> = {
oss: [],
"cloud:team": ["billing", "multi-tenancy", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav", "audit"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav", "audit"],
// Special entitlement for https://demo.sourcebot.dev
"cloud:demo": ["public-access", "code-nav", "search-contexts"],
} as const;
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

feat(audit-logging): Adds audit logging support#355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 17 commits into from
Jun 18, 2025
Merged

feat(audit-logging): Adds audit logging support #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
13a7fb2
add audit factory skeleton
msukkari Jun 12, 2025
cba10b8
add additional audit events
msukkari Jun 13, 2025
584a8d1
add more audit logs
msukkari Jun 13, 2025
a66abf2
delete account join request when redeeming an invite
msukkari Jun 13, 2025
3f7734d
Merge branch 'msukkarieh/stale_join_request' into msukkarieh/audit
msukkari Jun 13, 2025
e9f80f0
add audit event for account request removed
msukkari Jun 14, 2025
0ba23c9
merge main
msukkari Jun 14, 2025
b00a429
Merge branch 'main' into msukkarieh/audit
msukkari Jun 14, 2025
559633c
wip api to fetch audits
msukkari Jun 17, 2025
9c97889
add check for audit with public access and entitlement
msukkari Jun 17, 2025
a38f2c4
merge main
msukkari Jun 17, 2025
185fcfa
fix issues with merge
msukkari Jun 17, 2025
47adbb4
add docs for audit logs
msukkari Jun 17, 2025
4aa5923
add proper audit log for audit fetch and proper handling of api key h…
msukkari Jun 17, 2025
85ce7ae
merge main
msukkari Jun 17, 2025
51606f2
format nit
msukkari Jun 17, 2025
c9876e9
feedback
msukkari Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Added
- Added audit logging. [#355](https://github.com/sourcebot-dev/sourcebot/pull/355)
<!-- @NOTE: this release includes a API change that affects the MCP package (@sourcebot/mcp). On release, bump the MCP package's version and delete this message. -->

### Fixed
Expand Down
3 changes: 2 additions & 1 deletion docs/docs.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,8 @@
]
},
"docs/configuration/transactional-emails",
"docs/configuration/structured-logging"
"docs/configuration/structured-logging",
"docs/configuration/audit-logs"
]
},
{
Expand Down
212 changes: 212 additions & 0 deletions docs/docs/configuration/audit-logs.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
---
title: Audit Logs
sidebarTitle: Audit logs
---

import LicenseKeyRequired from '/snippets/license-key-required.mdx'

<LicenseKeyRequired />

Audit logs are a collection of notable events performed by users within a Sourcebot deployment. Each audit log records information on the action taken, the user who performed the
action, and when the action took place.

This feature gives security and compliance teams the necessary information to ensure proper governance and administration of your Sourcebot deployment.

## Enabling Audit Logs
Audit logs must be explicitly enabled by setting the `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` [environment variable](/docs/configuration/environment-variables) to `true`

## Fetching Audit Logs
Audit logs are stored in the [postgres database](/docs/overview#architecture) connected to Sourcebot. To fetch all of the audit logs, you can use the following API:

```bash icon="terminal" Fetch audit logs
curl --request GET '$SOURCEBOT_URL/api/ee/audit' \
--header 'X-Org-Domain: ~' \
--header 'X-Sourcebot-Api-Key: $SOURCEBOT_OWNER_API_KEY'
```

```json icon="brackets-curly" wrap expandable Fetch audit logs example response
[
{
"id": "cmc146k7m0003xgo2tri5t4br",
"timestamp": "2025-06-17T22:48:08.914Z",
"action": "api_key.created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "205d1da1c6c3772b81d4ad697f5851fa11195176c211055ff0c1509772645d6d",
"targetType": "api_key",
"sourcebotVersion": "unknown",
"orgId": 1
},
{
"id": "cmc146c8r0001xgo2xyu0p463",
"timestamp": "2025-06-17T22:47:58.587Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12vqgb0008xgn5nv5hl9y5",
"timestamp": "2025-06-17T22:11:44.171Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12txwn0006xgn51ow1odid",
"timestamp": "2025-06-17T22:10:20.519Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12tnjx0004xgn5qqeiv1ao",
"timestamp": "2025-06-17T22:10:07.101Z",
"action": "user.owner_created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
},
{
"id": "cmc12tnjh0002xgn5h6vzu3rl",
"timestamp": "2025-06-17T22:10:07.086Z",
"action": "user.signed_in",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "cmc12tnje0000xgn58jj8655h",
"targetType": "user",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
}
]
```

## Audit action types

| Action | Actor Type | Target Type |
| :------- | :------ | :------|
| `api_key.creation_failed` | `user` | `org` |
| `api_key.created` | `user` | `api_key` |
| `api_key.deletion_failed` | `user` | `org` |
| `api_key.deleted` | `user` | `api_key` |
| `user.creation_failed` | `user` | `user` |
| `user.owner_created` | `user` | `org` |
| `user.jit_provisioning_failed` | `user` | `org` |
| `user.jit_provisioned` | `user` | `org` |
| `user.join_request_creation_failed` | `user` | `org` |
| `user.join_requested` | `user` | `org` |
| `user.join_request_approve_failed` | `user` | `account_join_request` |
| `user.join_request_approved` | `user` | `account_join_request` |
| `user.join_request_removed` | `user` | `account_join_request` |
| `user.invite_failed` | `user` | `org` |
| `user.invites_created` | `user` | `org` |
| `user.invite_accept_failed` | `user` | `invite` |
| `user.invite_accepted` | `user` | `invite` |
| `user.signed_in` | `user` | `user` |
| `user.signed_out` | `user` | `user` |
| `org.ownership_transfer_failed` | `user` | `org` |
| `org.ownership_transferred` | `user` | `org` |
| `query.file_source` | `user \| api_key` | `file` |
| `query.code_search` | `user \| api_key` | `org` |
| `query.list_repositories` | `user \| api_key` | `org` |


## Response schema

```json icon="brackets-curly" expandable wrap Audit log fetch response schema
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "FetchAuditLogsResponse",
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"timestamp",
"action",
"actorId",
"actorType",
"targetId",
"targetType",
"sourcebotVersion",
"metadata",
"orgId"
],
"properties": {
"id": {
"type": "string"
},
"timestamp": {
"type": "string",
"format": "date-time"
},
"action": {
"type": "string"
},
"actorId": {
"type": "string"
},
"actorType": {
"type": "string",
"enum": ["user", "api_key"]
},
"targetId": {
"type": "string"
},
"targetType": {
"type": "string",
"enum": ["user", "org", "file", "api_key", "account_join_request", "invite"]
},
"sourcebotVersion": {
"type": "string"
},
"metadata": {
"anyOf": [
{
"type": "object",
"properties": {
"message": { "type": "string" },
"api_key": { "type": "string" },
"emails": { "type": "string" }
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"orgId": {
"type": "integer"
}
},
"additionalProperties": false
}
}

```
1 change: 1 addition & 0 deletions docs/docs/configuration/environment-variables.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,6 +39,7 @@ The following environment variables allow you to configure your Sourcebot deploy
### Enterprise Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` | `false` | <p>Enables/disables audit logging</p> |
| `AUTH_EE_ENABLE_JIT_PROVISIONING` | `false` | <p>Enables/disables just-in-time user provisioning for SSO providers.</p> |
| `AUTH_EE_GITHUB_BASE_URL` | `https://github.com` | <p>The base URL for GitHub Enterprise SSO authentication.</p> |
| `AUTH_EE_GITHUB_CLIENT_ID` | `-` | <p>The client ID for GitHub Enterprise SSO authentication.</p> |
Expand Down
3 changes: 2 additions & 1 deletion docs/docs/configuration/structured-logging.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
---
title: Structured logging
title: Structured Logging
sidebarTitle: Structured logging
---

By default, Sourcebot will output logs to the console in a human readable format. If you'd like Sourcebot to output structured JSON logs, set the following env vars:
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/deployment-guide.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,7 +33,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot
<Step title="Create a config.json">
Create a `config.json` file that tells Sourcebot which repositories to sync and index:

```bash
```bash wrap icon="terminal" Create example config
touch config.json
echo '{
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
Expand All@@ -58,7 +58,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot

In the same directory as `config.json`, run the following command to start your instance:

``` bash
``` bash icon="terminal" Start the Sourcebot container
docker run \
-p 3000:3000 \
--pull=always \
Expand Down
21 changes: 21 additions & 0 deletions packages/db/prisma/migrations/20250617031335_add_audit_table/migration.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
-- CreateTable
CREATE TABLE "Audit" (
"id" TEXT NOT NULL,
"timestamp" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"action" TEXT NOT NULL,
"actorId" TEXT NOT NULL,
"actorType" TEXT NOT NULL,
"targetId" TEXT NOT NULL,
"targetType" TEXT NOT NULL,
"sourcebotVersion" TEXT NOT NULL,
"metadata" JSONB,
"orgId" INTEGER NOT NULL,

CONSTRAINT "Audit_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "Audit_actorId_actorType_targetId_targetType_orgId_idx" ON "Audit"("actorId", "actorType", "targetId", "targetType", "orgId");

-- AddForeignKey
ALTER TABLE "Audit" ADD CONSTRAINT "Audit_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
20 changes: 20 additions & 0 deletions packages/db/prisma/schema.prisma
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -172,6 +172,8 @@ model Org {
/// List of pending invites to this organization
invites Invite[]

audits Audit[]

accountRequests AccountRequest[]

searchContexts SearchContext[]
Expand DownExpand Up@@ -227,6 +229,24 @@ model ApiKey {

}

model Audit {
id String @id @default(cuid())
timestamp DateTime @default(now())

action String
actorId String
actorType String
targetId String
targetType String
sourcebotVersion String
metadata Json?

org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
orgId Int

@@index([actorId, actorType, targetId, targetType, orgId])
}

// @see : https://authjs.dev/concepts/database-models#user
model User {
id String @id @default(cuid())
Expand Down
7 changes: 4 additions & 3 deletions packages/shared/src/entitlements.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,15 +36,16 @@ const entitlements = [
"public-access",
"multi-tenancy",
"sso",
"code-nav"
"code-nav",
"audit"
] as const;
export type Entitlement = (typeof entitlements)[number];

const entitlementsByPlan: Record<Plan, Entitlement[]> = {
oss: [],
"cloud:team": ["billing", "multi-tenancy", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav", "audit"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav", "audit"],
// Special entitlement for https://demo.sourcebot.dev
"cloud:demo": ["public-access", "code-nav", "search-contexts"],
} as const;
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length \u003e 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

feat(audit-logging): Adds audit logging support#355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 17 commits into from
Jun 18, 2025
Merged

feat(audit-logging): Adds audit logging support #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
13a7fb2
add audit factory skeleton
msukkari Jun 12, 2025
cba10b8
add additional audit events
msukkari Jun 13, 2025
584a8d1
add more audit logs
msukkari Jun 13, 2025
a66abf2
delete account join request when redeeming an invite
msukkari Jun 13, 2025
3f7734d
Merge branch 'msukkarieh/stale_join_request' into msukkarieh/audit
msukkari Jun 13, 2025
e9f80f0
add audit event for account request removed
msukkari Jun 14, 2025
0ba23c9
merge main
msukkari Jun 14, 2025
b00a429
Merge branch 'main' into msukkarieh/audit
msukkari Jun 14, 2025
559633c
wip api to fetch audits
msukkari Jun 17, 2025
9c97889
add check for audit with public access and entitlement
msukkari Jun 17, 2025
a38f2c4
merge main
msukkari Jun 17, 2025
185fcfa
fix issues with merge
msukkari Jun 17, 2025
47adbb4
add docs for audit logs
msukkari Jun 17, 2025
4aa5923
add proper audit log for audit fetch and proper handling of api key h…
msukkari Jun 17, 2025
85ce7ae
merge main
msukkari Jun 17, 2025
51606f2
format nit
msukkari Jun 17, 2025
c9876e9
feedback
msukkari Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Added
- Added audit logging. [#355](https://github.com/sourcebot-dev/sourcebot/pull/355)
<!-- @NOTE: this release includes a API change that affects the MCP package (@sourcebot/mcp). On release, bump the MCP package's version and delete this message. -->

### Fixed
Expand Down
3 changes: 2 additions & 1 deletion docs/docs.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,8 @@
]
},
"docs/configuration/transactional-emails",
"docs/configuration/structured-logging"
"docs/configuration/structured-logging",
"docs/configuration/audit-logs"
]
},
{
Expand Down
212 changes: 212 additions & 0 deletions docs/docs/configuration/audit-logs.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
---
title: Audit Logs
sidebarTitle: Audit logs
---

import LicenseKeyRequired from '/snippets/license-key-required.mdx'

<LicenseKeyRequired />

Audit logs are a collection of notable events performed by users within a Sourcebot deployment. Each audit log records information on the action taken, the user who performed the
action, and when the action took place.

This feature gives security and compliance teams the necessary information to ensure proper governance and administration of your Sourcebot deployment.

## Enabling Audit Logs
Audit logs must be explicitly enabled by setting the `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` [environment variable](/docs/configuration/environment-variables) to `true`

## Fetching Audit Logs
Audit logs are stored in the [postgres database](/docs/overview#architecture) connected to Sourcebot. To fetch all of the audit logs, you can use the following API:

```bash icon="terminal" Fetch audit logs
curl --request GET '$SOURCEBOT_URL/api/ee/audit' \
--header 'X-Org-Domain: ~' \
--header 'X-Sourcebot-Api-Key: $SOURCEBOT_OWNER_API_KEY'
```

```json icon="brackets-curly" wrap expandable Fetch audit logs example response
[
{
"id": "cmc146k7m0003xgo2tri5t4br",
"timestamp": "2025-06-17T22:48:08.914Z",
"action": "api_key.created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "205d1da1c6c3772b81d4ad697f5851fa11195176c211055ff0c1509772645d6d",
"targetType": "api_key",
"sourcebotVersion": "unknown",
"orgId": 1
},
{
"id": "cmc146c8r0001xgo2xyu0p463",
"timestamp": "2025-06-17T22:47:58.587Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12vqgb0008xgn5nv5hl9y5",
"timestamp": "2025-06-17T22:11:44.171Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12txwn0006xgn51ow1odid",
"timestamp": "2025-06-17T22:10:20.519Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12tnjx0004xgn5qqeiv1ao",
"timestamp": "2025-06-17T22:10:07.101Z",
"action": "user.owner_created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
},
{
"id": "cmc12tnjh0002xgn5h6vzu3rl",
"timestamp": "2025-06-17T22:10:07.086Z",
"action": "user.signed_in",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "cmc12tnje0000xgn58jj8655h",
"targetType": "user",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
}
]
```

## Audit action types

| Action | Actor Type | Target Type |
| :------- | :------ | :------|
| `api_key.creation_failed` | `user` | `org` |
| `api_key.created` | `user` | `api_key` |
| `api_key.deletion_failed` | `user` | `org` |
| `api_key.deleted` | `user` | `api_key` |
| `user.creation_failed` | `user` | `user` |
| `user.owner_created` | `user` | `org` |
| `user.jit_provisioning_failed` | `user` | `org` |
| `user.jit_provisioned` | `user` | `org` |
| `user.join_request_creation_failed` | `user` | `org` |
| `user.join_requested` | `user` | `org` |
| `user.join_request_approve_failed` | `user` | `account_join_request` |
| `user.join_request_approved` | `user` | `account_join_request` |
| `user.join_request_removed` | `user` | `account_join_request` |
| `user.invite_failed` | `user` | `org` |
| `user.invites_created` | `user` | `org` |
| `user.invite_accept_failed` | `user` | `invite` |
| `user.invite_accepted` | `user` | `invite` |
| `user.signed_in` | `user` | `user` |
| `user.signed_out` | `user` | `user` |
| `org.ownership_transfer_failed` | `user` | `org` |
| `org.ownership_transferred` | `user` | `org` |
| `query.file_source` | `user \| api_key` | `file` |
| `query.code_search` | `user \| api_key` | `org` |
| `query.list_repositories` | `user \| api_key` | `org` |


## Response schema

```json icon="brackets-curly" expandable wrap Audit log fetch response schema
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "FetchAuditLogsResponse",
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"timestamp",
"action",
"actorId",
"actorType",
"targetId",
"targetType",
"sourcebotVersion",
"metadata",
"orgId"
],
"properties": {
"id": {
"type": "string"
},
"timestamp": {
"type": "string",
"format": "date-time"
},
"action": {
"type": "string"
},
"actorId": {
"type": "string"
},
"actorType": {
"type": "string",
"enum": ["user", "api_key"]
},
"targetId": {
"type": "string"
},
"targetType": {
"type": "string",
"enum": ["user", "org", "file", "api_key", "account_join_request", "invite"]
},
"sourcebotVersion": {
"type": "string"
},
"metadata": {
"anyOf": [
{
"type": "object",
"properties": {
"message": { "type": "string" },
"api_key": { "type": "string" },
"emails": { "type": "string" }
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"orgId": {
"type": "integer"
}
},
"additionalProperties": false
}
}

```
1 change: 1 addition & 0 deletions docs/docs/configuration/environment-variables.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,6 +39,7 @@ The following environment variables allow you to configure your Sourcebot deploy
### Enterprise Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` | `false` | <p>Enables/disables audit logging</p> |
| `AUTH_EE_ENABLE_JIT_PROVISIONING` | `false` | <p>Enables/disables just-in-time user provisioning for SSO providers.</p> |
| `AUTH_EE_GITHUB_BASE_URL` | `https://github.com` | <p>The base URL for GitHub Enterprise SSO authentication.</p> |
| `AUTH_EE_GITHUB_CLIENT_ID` | `-` | <p>The client ID for GitHub Enterprise SSO authentication.</p> |
Expand Down
3 changes: 2 additions & 1 deletion docs/docs/configuration/structured-logging.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
---
title: Structured logging
title: Structured Logging
sidebarTitle: Structured logging
---

By default, Sourcebot will output logs to the console in a human readable format. If you'd like Sourcebot to output structured JSON logs, set the following env vars:
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/deployment-guide.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,7 +33,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot
<Step title="Create a config.json">
Create a `config.json` file that tells Sourcebot which repositories to sync and index:

```bash
```bash wrap icon="terminal" Create example config
touch config.json
echo '{
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
Expand All@@ -58,7 +58,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot

In the same directory as `config.json`, run the following command to start your instance:

``` bash
``` bash icon="terminal" Start the Sourcebot container
docker run \
-p 3000:3000 \
--pull=always \
Expand Down
21 changes: 21 additions & 0 deletions packages/db/prisma/migrations/20250617031335_add_audit_table/migration.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
-- CreateTable
CREATE TABLE "Audit" (
"id" TEXT NOT NULL,
"timestamp" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"action" TEXT NOT NULL,
"actorId" TEXT NOT NULL,
"actorType" TEXT NOT NULL,
"targetId" TEXT NOT NULL,
"targetType" TEXT NOT NULL,
"sourcebotVersion" TEXT NOT NULL,
"metadata" JSONB,
"orgId" INTEGER NOT NULL,

CONSTRAINT "Audit_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "Audit_actorId_actorType_targetId_targetType_orgId_idx" ON "Audit"("actorId", "actorType", "targetId", "targetType", "orgId");

-- AddForeignKey
ALTER TABLE "Audit" ADD CONSTRAINT "Audit_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
20 changes: 20 additions & 0 deletions packages/db/prisma/schema.prisma
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -172,6 +172,8 @@ model Org {
/// List of pending invites to this organization
invites Invite[]

audits Audit[]

accountRequests AccountRequest[]

searchContexts SearchContext[]
Expand DownExpand Up@@ -227,6 +229,24 @@ model ApiKey {

}

model Audit {
id String @id @default(cuid())
timestamp DateTime @default(now())

action String
actorId String
actorType String
targetId String
targetType String
sourcebotVersion String
metadata Json?

org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
orgId Int

@@index([actorId, actorType, targetId, targetType, orgId])
}

// @see : https://authjs.dev/concepts/database-models#user
model User {
id String @id @default(cuid())
Expand Down
7 changes: 4 additions & 3 deletions packages/shared/src/entitlements.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,15 +36,16 @@ const entitlements = [
"public-access",
"multi-tenancy",
"sso",
"code-nav"
"code-nav",
"audit"
] as const;
export type Entitlement = (typeof entitlements)[number];

const entitlementsByPlan: Record<Plan, Entitlement[]> = {
oss: [],
"cloud:team": ["billing", "multi-tenancy", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav", "audit"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav", "audit"],
// Special entitlement for https://demo.sourcebot.dev
"cloud:demo": ["public-access", "code-nav", "search-contexts"],
} as const;
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

feat(audit-logging): Adds audit logging support#355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 17 commits into from
Jun 18, 2025
Merged

feat(audit-logging): Adds audit logging support #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
13a7fb2
add audit factory skeleton
msukkari Jun 12, 2025
cba10b8
add additional audit events
msukkari Jun 13, 2025
584a8d1
add more audit logs
msukkari Jun 13, 2025
a66abf2
delete account join request when redeeming an invite
msukkari Jun 13, 2025
3f7734d
Merge branch 'msukkarieh/stale_join_request' into msukkarieh/audit
msukkari Jun 13, 2025
e9f80f0
add audit event for account request removed
msukkari Jun 14, 2025
0ba23c9
merge main
msukkari Jun 14, 2025
b00a429
Merge branch 'main' into msukkarieh/audit
msukkari Jun 14, 2025
559633c
wip api to fetch audits
msukkari Jun 17, 2025
9c97889
add check for audit with public access and entitlement
msukkari Jun 17, 2025
a38f2c4
merge main
msukkari Jun 17, 2025
185fcfa
fix issues with merge
msukkari Jun 17, 2025
47adbb4
add docs for audit logs
msukkari Jun 17, 2025
4aa5923
add proper audit log for audit fetch and proper handling of api key h…
msukkari Jun 17, 2025
85ce7ae
merge main
msukkari Jun 17, 2025
51606f2
format nit
msukkari Jun 17, 2025
c9876e9
feedback
msukkari Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Added
- Added audit logging. [#355](https://github.com/sourcebot-dev/sourcebot/pull/355)
<!-- @NOTE: this release includes a API change that affects the MCP package (@sourcebot/mcp). On release, bump the MCP package's version and delete this message. -->

### Fixed
Expand Down
3 changes: 2 additions & 1 deletion docs/docs.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,8 @@
]
},
"docs/configuration/transactional-emails",
"docs/configuration/structured-logging"
"docs/configuration/structured-logging",
"docs/configuration/audit-logs"
]
},
{
Expand Down
212 changes: 212 additions & 0 deletions docs/docs/configuration/audit-logs.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
---
title: Audit Logs
sidebarTitle: Audit logs
---

import LicenseKeyRequired from '/snippets/license-key-required.mdx'

<LicenseKeyRequired />

Audit logs are a collection of notable events performed by users within a Sourcebot deployment. Each audit log records information on the action taken, the user who performed the
action, and when the action took place.

This feature gives security and compliance teams the necessary information to ensure proper governance and administration of your Sourcebot deployment.

## Enabling Audit Logs
Audit logs must be explicitly enabled by setting the `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` [environment variable](/docs/configuration/environment-variables) to `true`

## Fetching Audit Logs
Audit logs are stored in the [postgres database](/docs/overview#architecture) connected to Sourcebot. To fetch all of the audit logs, you can use the following API:

```bash icon="terminal" Fetch audit logs
curl --request GET '$SOURCEBOT_URL/api/ee/audit' \
--header 'X-Org-Domain: ~' \
--header 'X-Sourcebot-Api-Key: $SOURCEBOT_OWNER_API_KEY'
```

```json icon="brackets-curly" wrap expandable Fetch audit logs example response
[
{
"id": "cmc146k7m0003xgo2tri5t4br",
"timestamp": "2025-06-17T22:48:08.914Z",
"action": "api_key.created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "205d1da1c6c3772b81d4ad697f5851fa11195176c211055ff0c1509772645d6d",
"targetType": "api_key",
"sourcebotVersion": "unknown",
"orgId": 1
},
{
"id": "cmc146c8r0001xgo2xyu0p463",
"timestamp": "2025-06-17T22:47:58.587Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12vqgb0008xgn5nv5hl9y5",
"timestamp": "2025-06-17T22:11:44.171Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12txwn0006xgn51ow1odid",
"timestamp": "2025-06-17T22:10:20.519Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12tnjx0004xgn5qqeiv1ao",
"timestamp": "2025-06-17T22:10:07.101Z",
"action": "user.owner_created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
},
{
"id": "cmc12tnjh0002xgn5h6vzu3rl",
"timestamp": "2025-06-17T22:10:07.086Z",
"action": "user.signed_in",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "cmc12tnje0000xgn58jj8655h",
"targetType": "user",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
}
]
```

## Audit action types

| Action | Actor Type | Target Type |
| :------- | :------ | :------|
| `api_key.creation_failed` | `user` | `org` |
| `api_key.created` | `user` | `api_key` |
| `api_key.deletion_failed` | `user` | `org` |
| `api_key.deleted` | `user` | `api_key` |
| `user.creation_failed` | `user` | `user` |
| `user.owner_created` | `user` | `org` |
| `user.jit_provisioning_failed` | `user` | `org` |
| `user.jit_provisioned` | `user` | `org` |
| `user.join_request_creation_failed` | `user` | `org` |
| `user.join_requested` | `user` | `org` |
| `user.join_request_approve_failed` | `user` | `account_join_request` |
| `user.join_request_approved` | `user` | `account_join_request` |
| `user.join_request_removed` | `user` | `account_join_request` |
| `user.invite_failed` | `user` | `org` |
| `user.invites_created` | `user` | `org` |
| `user.invite_accept_failed` | `user` | `invite` |
| `user.invite_accepted` | `user` | `invite` |
| `user.signed_in` | `user` | `user` |
| `user.signed_out` | `user` | `user` |
| `org.ownership_transfer_failed` | `user` | `org` |
| `org.ownership_transferred` | `user` | `org` |
| `query.file_source` | `user \| api_key` | `file` |
| `query.code_search` | `user \| api_key` | `org` |
| `query.list_repositories` | `user \| api_key` | `org` |


## Response schema

```json icon="brackets-curly" expandable wrap Audit log fetch response schema
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "FetchAuditLogsResponse",
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"timestamp",
"action",
"actorId",
"actorType",
"targetId",
"targetType",
"sourcebotVersion",
"metadata",
"orgId"
],
"properties": {
"id": {
"type": "string"
},
"timestamp": {
"type": "string",
"format": "date-time"
},
"action": {
"type": "string"
},
"actorId": {
"type": "string"
},
"actorType": {
"type": "string",
"enum": ["user", "api_key"]
},
"targetId": {
"type": "string"
},
"targetType": {
"type": "string",
"enum": ["user", "org", "file", "api_key", "account_join_request", "invite"]
},
"sourcebotVersion": {
"type": "string"
},
"metadata": {
"anyOf": [
{
"type": "object",
"properties": {
"message": { "type": "string" },
"api_key": { "type": "string" },
"emails": { "type": "string" }
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"orgId": {
"type": "integer"
}
},
"additionalProperties": false
}
}

```
1 change: 1 addition & 0 deletions docs/docs/configuration/environment-variables.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,6 +39,7 @@ The following environment variables allow you to configure your Sourcebot deploy
### Enterprise Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` | `false` | <p>Enables/disables audit logging</p> |
| `AUTH_EE_ENABLE_JIT_PROVISIONING` | `false` | <p>Enables/disables just-in-time user provisioning for SSO providers.</p> |
| `AUTH_EE_GITHUB_BASE_URL` | `https://github.com` | <p>The base URL for GitHub Enterprise SSO authentication.</p> |
| `AUTH_EE_GITHUB_CLIENT_ID` | `-` | <p>The client ID for GitHub Enterprise SSO authentication.</p> |
Expand Down
3 changes: 2 additions & 1 deletion docs/docs/configuration/structured-logging.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
---
title: Structured logging
title: Structured Logging
sidebarTitle: Structured logging
---

By default, Sourcebot will output logs to the console in a human readable format. If you'd like Sourcebot to output structured JSON logs, set the following env vars:
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/deployment-guide.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,7 +33,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot
<Step title="Create a config.json">
Create a `config.json` file that tells Sourcebot which repositories to sync and index:

```bash
```bash wrap icon="terminal" Create example config
touch config.json
echo '{
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
Expand All@@ -58,7 +58,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot

In the same directory as `config.json`, run the following command to start your instance:

``` bash
``` bash icon="terminal" Start the Sourcebot container
docker run \
-p 3000:3000 \
--pull=always \
Expand Down
21 changes: 21 additions & 0 deletions packages/db/prisma/migrations/20250617031335_add_audit_table/migration.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
-- CreateTable
CREATE TABLE "Audit" (
"id" TEXT NOT NULL,
"timestamp" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"action" TEXT NOT NULL,
"actorId" TEXT NOT NULL,
"actorType" TEXT NOT NULL,
"targetId" TEXT NOT NULL,
"targetType" TEXT NOT NULL,
"sourcebotVersion" TEXT NOT NULL,
"metadata" JSONB,
"orgId" INTEGER NOT NULL,

CONSTRAINT "Audit_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "Audit_actorId_actorType_targetId_targetType_orgId_idx" ON "Audit"("actorId", "actorType", "targetId", "targetType", "orgId");

-- AddForeignKey
ALTER TABLE "Audit" ADD CONSTRAINT "Audit_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
20 changes: 20 additions & 0 deletions packages/db/prisma/schema.prisma
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -172,6 +172,8 @@ model Org {
/// List of pending invites to this organization
invites Invite[]

audits Audit[]

accountRequests AccountRequest[]

searchContexts SearchContext[]
Expand DownExpand Up@@ -227,6 +229,24 @@ model ApiKey {

}

model Audit {
id String @id @default(cuid())
timestamp DateTime @default(now())

action String
actorId String
actorType String
targetId String
targetType String
sourcebotVersion String
metadata Json?

org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
orgId Int

@@index([actorId, actorType, targetId, targetType, orgId])
}

// @see : https://authjs.dev/concepts/database-models#user
model User {
id String @id @default(cuid())
Expand Down
7 changes: 4 additions & 3 deletions packages/shared/src/entitlements.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,15 +36,16 @@ const entitlements = [
"public-access",
"multi-tenancy",
"sso",
"code-nav"
"code-nav",
"audit"
] as const;
export type Entitlement = (typeof entitlements)[number];

const entitlementsByPlan: Record<Plan, Entitlement[]> = {
oss: [],
"cloud:team": ["billing", "multi-tenancy", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav", "audit"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav", "audit"],
// Special entitlement for https://demo.sourcebot.dev
"cloud:demo": ["public-access", "code-nav", "search-contexts"],
} as const;
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

feat(audit-logging): Adds audit logging support#355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 17 commits into from
Jun 18, 2025
Merged

feat(audit-logging): Adds audit logging support #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
13a7fb2
add audit factory skeleton
msukkari Jun 12, 2025
cba10b8
add additional audit events
msukkari Jun 13, 2025
584a8d1
add more audit logs
msukkari Jun 13, 2025
a66abf2
delete account join request when redeeming an invite
msukkari Jun 13, 2025
3f7734d
Merge branch 'msukkarieh/stale_join_request' into msukkarieh/audit
msukkari Jun 13, 2025
e9f80f0
add audit event for account request removed
msukkari Jun 14, 2025
0ba23c9
merge main
msukkari Jun 14, 2025
b00a429
Merge branch 'main' into msukkarieh/audit
msukkari Jun 14, 2025
559633c
wip api to fetch audits
msukkari Jun 17, 2025
9c97889
add check for audit with public access and entitlement
msukkari Jun 17, 2025
a38f2c4
merge main
msukkari Jun 17, 2025
185fcfa
fix issues with merge
msukkari Jun 17, 2025
47adbb4
add docs for audit logs
msukkari Jun 17, 2025
4aa5923
add proper audit log for audit fetch and proper handling of api key h…
msukkari Jun 17, 2025
85ce7ae
merge main
msukkari Jun 17, 2025
51606f2
format nit
msukkari Jun 17, 2025
c9876e9
feedback
msukkari Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Added
- Added audit logging. [#355](https://github.com/sourcebot-dev/sourcebot/pull/355)
<!-- @NOTE: this release includes a API change that affects the MCP package (@sourcebot/mcp). On release, bump the MCP package's version and delete this message. -->

### Fixed
Expand Down
3 changes: 2 additions & 1 deletion docs/docs.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,8 @@
]
},
"docs/configuration/transactional-emails",
"docs/configuration/structured-logging"
"docs/configuration/structured-logging",
"docs/configuration/audit-logs"
]
},
{
Expand Down
212 changes: 212 additions & 0 deletions docs/docs/configuration/audit-logs.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
---
title: Audit Logs
sidebarTitle: Audit logs
---

import LicenseKeyRequired from '/snippets/license-key-required.mdx'

<LicenseKeyRequired />

Audit logs are a collection of notable events performed by users within a Sourcebot deployment. Each audit log records information on the action taken, the user who performed the
action, and when the action took place.

This feature gives security and compliance teams the necessary information to ensure proper governance and administration of your Sourcebot deployment.

## Enabling Audit Logs
Audit logs must be explicitly enabled by setting the `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` [environment variable](/docs/configuration/environment-variables) to `true`

## Fetching Audit Logs
Audit logs are stored in the [postgres database](/docs/overview#architecture) connected to Sourcebot. To fetch all of the audit logs, you can use the following API:

```bash icon="terminal" Fetch audit logs
curl --request GET '$SOURCEBOT_URL/api/ee/audit' \
--header 'X-Org-Domain: ~' \
--header 'X-Sourcebot-Api-Key: $SOURCEBOT_OWNER_API_KEY'
```

```json icon="brackets-curly" wrap expandable Fetch audit logs example response
[
{
"id": "cmc146k7m0003xgo2tri5t4br",
"timestamp": "2025-06-17T22:48:08.914Z",
"action": "api_key.created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "205d1da1c6c3772b81d4ad697f5851fa11195176c211055ff0c1509772645d6d",
"targetType": "api_key",
"sourcebotVersion": "unknown",
"orgId": 1
},
{
"id": "cmc146c8r0001xgo2xyu0p463",
"timestamp": "2025-06-17T22:47:58.587Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12vqgb0008xgn5nv5hl9y5",
"timestamp": "2025-06-17T22:11:44.171Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12txwn0006xgn51ow1odid",
"timestamp": "2025-06-17T22:10:20.519Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12tnjx0004xgn5qqeiv1ao",
"timestamp": "2025-06-17T22:10:07.101Z",
"action": "user.owner_created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
},
{
"id": "cmc12tnjh0002xgn5h6vzu3rl",
"timestamp": "2025-06-17T22:10:07.086Z",
"action": "user.signed_in",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "cmc12tnje0000xgn58jj8655h",
"targetType": "user",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
}
]
```

## Audit action types

| Action | Actor Type | Target Type |
| :------- | :------ | :------|
| `api_key.creation_failed` | `user` | `org` |
| `api_key.created` | `user` | `api_key` |
| `api_key.deletion_failed` | `user` | `org` |
| `api_key.deleted` | `user` | `api_key` |
| `user.creation_failed` | `user` | `user` |
| `user.owner_created` | `user` | `org` |
| `user.jit_provisioning_failed` | `user` | `org` |
| `user.jit_provisioned` | `user` | `org` |
| `user.join_request_creation_failed` | `user` | `org` |
| `user.join_requested` | `user` | `org` |
| `user.join_request_approve_failed` | `user` | `account_join_request` |
| `user.join_request_approved` | `user` | `account_join_request` |
| `user.join_request_removed` | `user` | `account_join_request` |
| `user.invite_failed` | `user` | `org` |
| `user.invites_created` | `user` | `org` |
| `user.invite_accept_failed` | `user` | `invite` |
| `user.invite_accepted` | `user` | `invite` |
| `user.signed_in` | `user` | `user` |
| `user.signed_out` | `user` | `user` |
| `org.ownership_transfer_failed` | `user` | `org` |
| `org.ownership_transferred` | `user` | `org` |
| `query.file_source` | `user \| api_key` | `file` |
| `query.code_search` | `user \| api_key` | `org` |
| `query.list_repositories` | `user \| api_key` | `org` |


## Response schema

```json icon="brackets-curly" expandable wrap Audit log fetch response schema
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "FetchAuditLogsResponse",
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"timestamp",
"action",
"actorId",
"actorType",
"targetId",
"targetType",
"sourcebotVersion",
"metadata",
"orgId"
],
"properties": {
"id": {
"type": "string"
},
"timestamp": {
"type": "string",
"format": "date-time"
},
"action": {
"type": "string"
},
"actorId": {
"type": "string"
},
"actorType": {
"type": "string",
"enum": ["user", "api_key"]
},
"targetId": {
"type": "string"
},
"targetType": {
"type": "string",
"enum": ["user", "org", "file", "api_key", "account_join_request", "invite"]
},
"sourcebotVersion": {
"type": "string"
},
"metadata": {
"anyOf": [
{
"type": "object",
"properties": {
"message": { "type": "string" },
"api_key": { "type": "string" },
"emails": { "type": "string" }
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"orgId": {
"type": "integer"
}
},
"additionalProperties": false
}
}

```
1 change: 1 addition & 0 deletions docs/docs/configuration/environment-variables.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,6 +39,7 @@ The following environment variables allow you to configure your Sourcebot deploy
### Enterprise Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` | `false` | <p>Enables/disables audit logging</p> |
| `AUTH_EE_ENABLE_JIT_PROVISIONING` | `false` | <p>Enables/disables just-in-time user provisioning for SSO providers.</p> |
| `AUTH_EE_GITHUB_BASE_URL` | `https://github.com` | <p>The base URL for GitHub Enterprise SSO authentication.</p> |
| `AUTH_EE_GITHUB_CLIENT_ID` | `-` | <p>The client ID for GitHub Enterprise SSO authentication.</p> |
Expand Down
3 changes: 2 additions & 1 deletion docs/docs/configuration/structured-logging.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
---
title: Structured logging
title: Structured Logging
sidebarTitle: Structured logging
---

By default, Sourcebot will output logs to the console in a human readable format. If you'd like Sourcebot to output structured JSON logs, set the following env vars:
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/deployment-guide.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,7 +33,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot
<Step title="Create a config.json">
Create a `config.json` file that tells Sourcebot which repositories to sync and index:

```bash
```bash wrap icon="terminal" Create example config
touch config.json
echo '{
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
Expand All@@ -58,7 +58,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot

In the same directory as `config.json`, run the following command to start your instance:

``` bash
``` bash icon="terminal" Start the Sourcebot container
docker run \
-p 3000:3000 \
--pull=always \
Expand Down
21 changes: 21 additions & 0 deletions packages/db/prisma/migrations/20250617031335_add_audit_table/migration.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
-- CreateTable
CREATE TABLE "Audit" (
"id" TEXT NOT NULL,
"timestamp" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"action" TEXT NOT NULL,
"actorId" TEXT NOT NULL,
"actorType" TEXT NOT NULL,
"targetId" TEXT NOT NULL,
"targetType" TEXT NOT NULL,
"sourcebotVersion" TEXT NOT NULL,
"metadata" JSONB,
"orgId" INTEGER NOT NULL,

CONSTRAINT "Audit_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "Audit_actorId_actorType_targetId_targetType_orgId_idx" ON "Audit"("actorId", "actorType", "targetId", "targetType", "orgId");

-- AddForeignKey
ALTER TABLE "Audit" ADD CONSTRAINT "Audit_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
20 changes: 20 additions & 0 deletions packages/db/prisma/schema.prisma
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -172,6 +172,8 @@ model Org {
/// List of pending invites to this organization
invites Invite[]

audits Audit[]

accountRequests AccountRequest[]

searchContexts SearchContext[]
Expand DownExpand Up@@ -227,6 +229,24 @@ model ApiKey {

}

model Audit {
id String @id @default(cuid())
timestamp DateTime @default(now())

action String
actorId String
actorType String
targetId String
targetType String
sourcebotVersion String
metadata Json?

org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
orgId Int

@@index([actorId, actorType, targetId, targetType, orgId])
}

// @see : https://authjs.dev/concepts/database-models#user
model User {
id String @id @default(cuid())
Expand Down
7 changes: 4 additions & 3 deletions packages/shared/src/entitlements.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,15 +36,16 @@ const entitlements = [
"public-access",
"multi-tenancy",
"sso",
"code-nav"
"code-nav",
"audit"
] as const;
export type Entitlement = (typeof entitlements)[number];

const entitlementsByPlan: Record<Plan, Entitlement[]> = {
oss: [],
"cloud:team": ["billing", "multi-tenancy", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav", "audit"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav", "audit"],
// Special entitlement for https://demo.sourcebot.dev
"cloud:demo": ["public-access", "code-nav", "search-contexts"],
} as const;
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

feat(audit-logging): Adds audit logging support#355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 17 commits into from
Jun 18, 2025
Merged

feat(audit-logging): Adds audit logging support #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
13a7fb2
add audit factory skeleton
msukkari Jun 12, 2025
cba10b8
add additional audit events
msukkari Jun 13, 2025
584a8d1
add more audit logs
msukkari Jun 13, 2025
a66abf2
delete account join request when redeeming an invite
msukkari Jun 13, 2025
3f7734d
Merge branch 'msukkarieh/stale_join_request' into msukkarieh/audit
msukkari Jun 13, 2025
e9f80f0
add audit event for account request removed
msukkari Jun 14, 2025
0ba23c9
merge main
msukkari Jun 14, 2025
b00a429
Merge branch 'main' into msukkarieh/audit
msukkari Jun 14, 2025
559633c
wip api to fetch audits
msukkari Jun 17, 2025
9c97889
add check for audit with public access and entitlement
msukkari Jun 17, 2025
a38f2c4
merge main
msukkari Jun 17, 2025
185fcfa
fix issues with merge
msukkari Jun 17, 2025
47adbb4
add docs for audit logs
msukkari Jun 17, 2025
4aa5923
add proper audit log for audit fetch and proper handling of api key h…
msukkari Jun 17, 2025
85ce7ae
merge main
msukkari Jun 17, 2025
51606f2
format nit
msukkari Jun 17, 2025
c9876e9
feedback
msukkari Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Added
- Added audit logging. [#355](https://github.com/sourcebot-dev/sourcebot/pull/355)
<!-- @NOTE: this release includes a API change that affects the MCP package (@sourcebot/mcp). On release, bump the MCP package's version and delete this message. -->

### Fixed
Expand Down
3 changes: 2 additions & 1 deletion docs/docs.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,8 @@
]
},
"docs/configuration/transactional-emails",
"docs/configuration/structured-logging"
"docs/configuration/structured-logging",
"docs/configuration/audit-logs"
]
},
{
Expand Down
212 changes: 212 additions & 0 deletions docs/docs/configuration/audit-logs.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
---
title: Audit Logs
sidebarTitle: Audit logs
---

import LicenseKeyRequired from '/snippets/license-key-required.mdx'

<LicenseKeyRequired />

Audit logs are a collection of notable events performed by users within a Sourcebot deployment. Each audit log records information on the action taken, the user who performed the
action, and when the action took place.

This feature gives security and compliance teams the necessary information to ensure proper governance and administration of your Sourcebot deployment.

## Enabling Audit Logs
Audit logs must be explicitly enabled by setting the `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` [environment variable](/docs/configuration/environment-variables) to `true`

## Fetching Audit Logs
Audit logs are stored in the [postgres database](/docs/overview#architecture) connected to Sourcebot. To fetch all of the audit logs, you can use the following API:

```bash icon="terminal" Fetch audit logs
curl --request GET '$SOURCEBOT_URL/api/ee/audit' \
--header 'X-Org-Domain: ~' \
--header 'X-Sourcebot-Api-Key: $SOURCEBOT_OWNER_API_KEY'
```

```json icon="brackets-curly" wrap expandable Fetch audit logs example response
[
{
"id": "cmc146k7m0003xgo2tri5t4br",
"timestamp": "2025-06-17T22:48:08.914Z",
"action": "api_key.created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "205d1da1c6c3772b81d4ad697f5851fa11195176c211055ff0c1509772645d6d",
"targetType": "api_key",
"sourcebotVersion": "unknown",
"orgId": 1
},
{
"id": "cmc146c8r0001xgo2xyu0p463",
"timestamp": "2025-06-17T22:47:58.587Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12vqgb0008xgn5nv5hl9y5",
"timestamp": "2025-06-17T22:11:44.171Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12txwn0006xgn51ow1odid",
"timestamp": "2025-06-17T22:10:20.519Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12tnjx0004xgn5qqeiv1ao",
"timestamp": "2025-06-17T22:10:07.101Z",
"action": "user.owner_created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
},
{
"id": "cmc12tnjh0002xgn5h6vzu3rl",
"timestamp": "2025-06-17T22:10:07.086Z",
"action": "user.signed_in",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "cmc12tnje0000xgn58jj8655h",
"targetType": "user",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
}
]
```

## Audit action types

| Action | Actor Type | Target Type |
| :------- | :------ | :------|
| `api_key.creation_failed` | `user` | `org` |
| `api_key.created` | `user` | `api_key` |
| `api_key.deletion_failed` | `user` | `org` |
| `api_key.deleted` | `user` | `api_key` |
| `user.creation_failed` | `user` | `user` |
| `user.owner_created` | `user` | `org` |
| `user.jit_provisioning_failed` | `user` | `org` |
| `user.jit_provisioned` | `user` | `org` |
| `user.join_request_creation_failed` | `user` | `org` |
| `user.join_requested` | `user` | `org` |
| `user.join_request_approve_failed` | `user` | `account_join_request` |
| `user.join_request_approved` | `user` | `account_join_request` |
| `user.join_request_removed` | `user` | `account_join_request` |
| `user.invite_failed` | `user` | `org` |
| `user.invites_created` | `user` | `org` |
| `user.invite_accept_failed` | `user` | `invite` |
| `user.invite_accepted` | `user` | `invite` |
| `user.signed_in` | `user` | `user` |
| `user.signed_out` | `user` | `user` |
| `org.ownership_transfer_failed` | `user` | `org` |
| `org.ownership_transferred` | `user` | `org` |
| `query.file_source` | `user \| api_key` | `file` |
| `query.code_search` | `user \| api_key` | `org` |
| `query.list_repositories` | `user \| api_key` | `org` |


## Response schema

```json icon="brackets-curly" expandable wrap Audit log fetch response schema
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "FetchAuditLogsResponse",
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"timestamp",
"action",
"actorId",
"actorType",
"targetId",
"targetType",
"sourcebotVersion",
"metadata",
"orgId"
],
"properties": {
"id": {
"type": "string"
},
"timestamp": {
"type": "string",
"format": "date-time"
},
"action": {
"type": "string"
},
"actorId": {
"type": "string"
},
"actorType": {
"type": "string",
"enum": ["user", "api_key"]
},
"targetId": {
"type": "string"
},
"targetType": {
"type": "string",
"enum": ["user", "org", "file", "api_key", "account_join_request", "invite"]
},
"sourcebotVersion": {
"type": "string"
},
"metadata": {
"anyOf": [
{
"type": "object",
"properties": {
"message": { "type": "string" },
"api_key": { "type": "string" },
"emails": { "type": "string" }
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"orgId": {
"type": "integer"
}
},
"additionalProperties": false
}
}

```
1 change: 1 addition & 0 deletions docs/docs/configuration/environment-variables.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,6 +39,7 @@ The following environment variables allow you to configure your Sourcebot deploy
### Enterprise Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` | `false` | <p>Enables/disables audit logging</p> |
| `AUTH_EE_ENABLE_JIT_PROVISIONING` | `false` | <p>Enables/disables just-in-time user provisioning for SSO providers.</p> |
| `AUTH_EE_GITHUB_BASE_URL` | `https://github.com` | <p>The base URL for GitHub Enterprise SSO authentication.</p> |
| `AUTH_EE_GITHUB_CLIENT_ID` | `-` | <p>The client ID for GitHub Enterprise SSO authentication.</p> |
Expand Down
3 changes: 2 additions & 1 deletion docs/docs/configuration/structured-logging.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
---
title: Structured logging
title: Structured Logging
sidebarTitle: Structured logging
---

By default, Sourcebot will output logs to the console in a human readable format. If you'd like Sourcebot to output structured JSON logs, set the following env vars:
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/deployment-guide.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,7 +33,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot
<Step title="Create a config.json">
Create a `config.json` file that tells Sourcebot which repositories to sync and index:

```bash
```bash wrap icon="terminal" Create example config
touch config.json
echo '{
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
Expand All@@ -58,7 +58,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot

In the same directory as `config.json`, run the following command to start your instance:

``` bash
``` bash icon="terminal" Start the Sourcebot container
docker run \
-p 3000:3000 \
--pull=always \
Expand Down
21 changes: 21 additions & 0 deletions packages/db/prisma/migrations/20250617031335_add_audit_table/migration.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
-- CreateTable
CREATE TABLE "Audit" (
"id" TEXT NOT NULL,
"timestamp" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"action" TEXT NOT NULL,
"actorId" TEXT NOT NULL,
"actorType" TEXT NOT NULL,
"targetId" TEXT NOT NULL,
"targetType" TEXT NOT NULL,
"sourcebotVersion" TEXT NOT NULL,
"metadata" JSONB,
"orgId" INTEGER NOT NULL,

CONSTRAINT "Audit_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "Audit_actorId_actorType_targetId_targetType_orgId_idx" ON "Audit"("actorId", "actorType", "targetId", "targetType", "orgId");

-- AddForeignKey
ALTER TABLE "Audit" ADD CONSTRAINT "Audit_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
20 changes: 20 additions & 0 deletions packages/db/prisma/schema.prisma
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -172,6 +172,8 @@ model Org {
/// List of pending invites to this organization
invites Invite[]

audits Audit[]

accountRequests AccountRequest[]

searchContexts SearchContext[]
Expand DownExpand Up@@ -227,6 +229,24 @@ model ApiKey {

}

model Audit {
id String @id @default(cuid())
timestamp DateTime @default(now())

action String
actorId String
actorType String
targetId String
targetType String
sourcebotVersion String
metadata Json?

org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
orgId Int

@@index([actorId, actorType, targetId, targetType, orgId])
}

// @see : https://authjs.dev/concepts/database-models#user
model User {
id String @id @default(cuid())
Expand Down
7 changes: 4 additions & 3 deletions packages/shared/src/entitlements.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,15 +36,16 @@ const entitlements = [
"public-access",
"multi-tenancy",
"sso",
"code-nav"
"code-nav",
"audit"
] as const;
export type Entitlement = (typeof entitlements)[number];

const entitlementsByPlan: Record<Plan, Entitlement[]> = {
oss: [],
"cloud:team": ["billing", "multi-tenancy", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav", "audit"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav", "audit"],
// Special entitlement for https://demo.sourcebot.dev
"cloud:demo": ["public-access", "code-nav", "search-contexts"],
} as const;
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

feat(audit-logging): Adds audit logging support#355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 17 commits into from
Jun 18, 2025
Merged

feat(audit-logging): Adds audit logging support #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
13a7fb2
add audit factory skeleton
msukkari Jun 12, 2025
cba10b8
add additional audit events
msukkari Jun 13, 2025
584a8d1
add more audit logs
msukkari Jun 13, 2025
a66abf2
delete account join request when redeeming an invite
msukkari Jun 13, 2025
3f7734d
Merge branch 'msukkarieh/stale_join_request' into msukkarieh/audit
msukkari Jun 13, 2025
e9f80f0
add audit event for account request removed
msukkari Jun 14, 2025
0ba23c9
merge main
msukkari Jun 14, 2025
b00a429
Merge branch 'main' into msukkarieh/audit
msukkari Jun 14, 2025
559633c
wip api to fetch audits
msukkari Jun 17, 2025
9c97889
add check for audit with public access and entitlement
msukkari Jun 17, 2025
a38f2c4
merge main
msukkari Jun 17, 2025
185fcfa
fix issues with merge
msukkari Jun 17, 2025
47adbb4
add docs for audit logs
msukkari Jun 17, 2025
4aa5923
add proper audit log for audit fetch and proper handling of api key h…
msukkari Jun 17, 2025
85ce7ae
merge main
msukkari Jun 17, 2025
51606f2
format nit
msukkari Jun 17, 2025
c9876e9
feedback
msukkari Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Added
- Added audit logging. [#355](https://github.com/sourcebot-dev/sourcebot/pull/355)
<!-- @NOTE: this release includes a API change that affects the MCP package (@sourcebot/mcp). On release, bump the MCP package's version and delete this message. -->

### Fixed
Expand Down
3 changes: 2 additions & 1 deletion docs/docs.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,8 @@
]
},
"docs/configuration/transactional-emails",
"docs/configuration/structured-logging"
"docs/configuration/structured-logging",
"docs/configuration/audit-logs"
]
},
{
Expand Down
212 changes: 212 additions & 0 deletions docs/docs/configuration/audit-logs.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
---
title: Audit Logs
sidebarTitle: Audit logs
---

import LicenseKeyRequired from '/snippets/license-key-required.mdx'

<LicenseKeyRequired />

Audit logs are a collection of notable events performed by users within a Sourcebot deployment. Each audit log records information on the action taken, the user who performed the
action, and when the action took place.

This feature gives security and compliance teams the necessary information to ensure proper governance and administration of your Sourcebot deployment.

## Enabling Audit Logs
Audit logs must be explicitly enabled by setting the `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` [environment variable](/docs/configuration/environment-variables) to `true`

## Fetching Audit Logs
Audit logs are stored in the [postgres database](/docs/overview#architecture) connected to Sourcebot. To fetch all of the audit logs, you can use the following API:

```bash icon="terminal" Fetch audit logs
curl --request GET '$SOURCEBOT_URL/api/ee/audit' \
--header 'X-Org-Domain: ~' \
--header 'X-Sourcebot-Api-Key: $SOURCEBOT_OWNER_API_KEY'
```

```json icon="brackets-curly" wrap expandable Fetch audit logs example response
[
{
"id": "cmc146k7m0003xgo2tri5t4br",
"timestamp": "2025-06-17T22:48:08.914Z",
"action": "api_key.created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "205d1da1c6c3772b81d4ad697f5851fa11195176c211055ff0c1509772645d6d",
"targetType": "api_key",
"sourcebotVersion": "unknown",
"orgId": 1
},
{
"id": "cmc146c8r0001xgo2xyu0p463",
"timestamp": "2025-06-17T22:47:58.587Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12vqgb0008xgn5nv5hl9y5",
"timestamp": "2025-06-17T22:11:44.171Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12txwn0006xgn51ow1odid",
"timestamp": "2025-06-17T22:10:20.519Z",
"action": "query.code_search",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": {
"message": "render branch:HEAD"
},
"orgId": 1
},
{
"id": "cmc12tnjx0004xgn5qqeiv1ao",
"timestamp": "2025-06-17T22:10:07.101Z",
"action": "user.owner_created",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "1",
"targetType": "org",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
},
{
"id": "cmc12tnjh0002xgn5h6vzu3rl",
"timestamp": "2025-06-17T22:10:07.086Z",
"action": "user.signed_in",
"actorId": "cmc12tnje0000xgn58jj8655h",
"actorType": "user",
"targetId": "cmc12tnje0000xgn58jj8655h",
"targetType": "user",
"sourcebotVersion": "unknown",
"metadata": null,
"orgId": 1
}
]
```

## Audit action types

| Action | Actor Type | Target Type |
| :------- | :------ | :------|
| `api_key.creation_failed` | `user` | `org` |
| `api_key.created` | `user` | `api_key` |
| `api_key.deletion_failed` | `user` | `org` |
| `api_key.deleted` | `user` | `api_key` |
| `user.creation_failed` | `user` | `user` |
| `user.owner_created` | `user` | `org` |
| `user.jit_provisioning_failed` | `user` | `org` |
| `user.jit_provisioned` | `user` | `org` |
| `user.join_request_creation_failed` | `user` | `org` |
| `user.join_requested` | `user` | `org` |
| `user.join_request_approve_failed` | `user` | `account_join_request` |
| `user.join_request_approved` | `user` | `account_join_request` |
| `user.join_request_removed` | `user` | `account_join_request` |
| `user.invite_failed` | `user` | `org` |
| `user.invites_created` | `user` | `org` |
| `user.invite_accept_failed` | `user` | `invite` |
| `user.invite_accepted` | `user` | `invite` |
| `user.signed_in` | `user` | `user` |
| `user.signed_out` | `user` | `user` |
| `org.ownership_transfer_failed` | `user` | `org` |
| `org.ownership_transferred` | `user` | `org` |
| `query.file_source` | `user \| api_key` | `file` |
| `query.code_search` | `user \| api_key` | `org` |
| `query.list_repositories` | `user \| api_key` | `org` |


## Response schema

```json icon="brackets-curly" expandable wrap Audit log fetch response schema
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "FetchAuditLogsResponse",
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"timestamp",
"action",
"actorId",
"actorType",
"targetId",
"targetType",
"sourcebotVersion",
"metadata",
"orgId"
],
"properties": {
"id": {
"type": "string"
},
"timestamp": {
"type": "string",
"format": "date-time"
},
"action": {
"type": "string"
},
"actorId": {
"type": "string"
},
"actorType": {
"type": "string",
"enum": ["user", "api_key"]
},
"targetId": {
"type": "string"
},
"targetType": {
"type": "string",
"enum": ["user", "org", "file", "api_key", "account_join_request", "invite"]
},
"sourcebotVersion": {
"type": "string"
},
"metadata": {
"anyOf": [
{
"type": "object",
"properties": {
"message": { "type": "string" },
"api_key": { "type": "string" },
"emails": { "type": "string" }
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"orgId": {
"type": "integer"
}
},
"additionalProperties": false
}
}

```
1 change: 1 addition & 0 deletions docs/docs/configuration/environment-variables.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,6 +39,7 @@ The following environment variables allow you to configure your Sourcebot deploy
### Enterprise Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `SOURCEBOT_EE_AUDIT_LOGGING_ENABLED` | `false` | <p>Enables/disables audit logging</p> |
| `AUTH_EE_ENABLE_JIT_PROVISIONING` | `false` | <p>Enables/disables just-in-time user provisioning for SSO providers.</p> |
| `AUTH_EE_GITHUB_BASE_URL` | `https://github.com` | <p>The base URL for GitHub Enterprise SSO authentication.</p> |
| `AUTH_EE_GITHUB_CLIENT_ID` | `-` | <p>The client ID for GitHub Enterprise SSO authentication.</p> |
Expand Down
3 changes: 2 additions & 1 deletion docs/docs/configuration/structured-logging.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
---
title: Structured logging
title: Structured Logging
sidebarTitle: Structured logging
---

By default, Sourcebot will output logs to the console in a human readable format. If you'd like Sourcebot to output structured JSON logs, set the following env vars:
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/deployment-guide.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,7 +33,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot
<Step title="Create a config.json">
Create a `config.json` file that tells Sourcebot which repositories to sync and index:

```bash
```bash wrap icon="terminal" Create example config
touch config.json
echo '{
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
Expand All@@ -58,7 +58,7 @@ Watch this 1:51 minute video to get a quick overview of how to deploy Sourcebot

In the same directory as `config.json`, run the following command to start your instance:

``` bash
``` bash icon="terminal" Start the Sourcebot container
docker run \
-p 3000:3000 \
--pull=always \
Expand Down
21 changes: 21 additions & 0 deletions packages/db/prisma/migrations/20250617031335_add_audit_table/migration.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
-- CreateTable
CREATE TABLE "Audit" (
"id" TEXT NOT NULL,
"timestamp" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"action" TEXT NOT NULL,
"actorId" TEXT NOT NULL,
"actorType" TEXT NOT NULL,
"targetId" TEXT NOT NULL,
"targetType" TEXT NOT NULL,
"sourcebotVersion" TEXT NOT NULL,
"metadata" JSONB,
"orgId" INTEGER NOT NULL,

CONSTRAINT "Audit_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "Audit_actorId_actorType_targetId_targetType_orgId_idx" ON "Audit"("actorId", "actorType", "targetId", "targetType", "orgId");

-- AddForeignKey
ALTER TABLE "Audit" ADD CONSTRAINT "Audit_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Org"("id") ON DELETE CASCADE ON UPDATE CASCADE;
20 changes: 20 additions & 0 deletions packages/db/prisma/schema.prisma
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -172,6 +172,8 @@ model Org {
/// List of pending invites to this organization
invites Invite[]

audits Audit[]

accountRequests AccountRequest[]

searchContexts SearchContext[]
Expand DownExpand Up@@ -227,6 +229,24 @@ model ApiKey {

}

model Audit {
id String @id @default(cuid())
timestamp DateTime @default(now())

action String
actorId String
actorType String
targetId String
targetType String
sourcebotVersion String
metadata Json?

org Org @relation(fields: [orgId], references: [id], onDelete: Cascade)
orgId Int

@@index([actorId, actorType, targetId, targetType, orgId])
}

// @see : https://authjs.dev/concepts/database-models#user
model User {
id String @id @default(cuid())
Expand Down
7 changes: 4 additions & 3 deletions packages/shared/src/entitlements.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,15 +36,16 @@ const entitlements = [
"public-access",
"multi-tenancy",
"sso",
"code-nav"
"code-nav",
"audit"
] as const;
export type Entitlement = (typeof entitlements)[number];

const entitlementsByPlan: Record<Plan, Entitlement[]> = {
oss: [],
"cloud:team": ["billing", "multi-tenancy", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav"],
"self-hosted:enterprise": ["search-contexts", "sso", "code-nav", "audit"],
"self-hosted:enterprise-unlimited": ["search-contexts", "public-access", "sso", "code-nav", "audit"],
// Special entitlement for https://demo.sourcebot.dev
"cloud:demo": ["public-access", "code-nav", "search-contexts"],
} as const;
Expand Down
Loading